* [PATCH 1/1] snmp6 relevant data structures are freed twice.
@ 2011-09-19 7:03 rongqing.li
2011-09-19 8:29 ` Eric Dumazet
0 siblings, 1 reply; 3+ messages in thread
From: rongqing.li @ 2011-09-19 7:03 UTC (permalink / raw)
To: netdev
From: Roy.Li <rongqing.li@windriver.com>
When calling snmp6_alloc_dev fails, the snmp6 relevant memory
are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy
will free these memory twice.
Double free will lead that undefined behavior occurs.
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
---
net/ipv6/addrconf.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8f1e5be..ba01f72 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -374,8 +374,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
"%s(): cannot allocate memory for statistics; dev=%s.\n",
__func__, dev->name));
neigh_parms_release(&nd_tbl, ndev->nd_parms);
- ndev->dead = 1;
- in6_dev_finish_destroy(ndev);
+ dev_put(dev);
+ kfree(ndev);
return NULL;
}
--
1.7.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] snmp6 relevant data structures are freed twice.
2011-09-19 7:03 [PATCH 1/1] snmp6 relevant data structures are freed twice rongqing.li
@ 2011-09-19 8:29 ` Eric Dumazet
2011-09-19 8:32 ` Rongqing Li
0 siblings, 1 reply; 3+ messages in thread
From: Eric Dumazet @ 2011-09-19 8:29 UTC (permalink / raw)
To: rongqing.li; +Cc: netdev
Le lundi 19 septembre 2011 à 15:03 +0800, rongqing.li@windriver.com a
écrit :
> From: Roy.Li <rongqing.li@windriver.com>
>
> When calling snmp6_alloc_dev fails, the snmp6 relevant memory
> are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy
> will free these memory twice.
>
> Double free will lead that undefined behavior occurs.
>
> Signed-off-by: Roy.Li <rongqing.li@windriver.com>
> ---
> net/ipv6/addrconf.c | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> index 8f1e5be..ba01f72 100644
> --- a/net/ipv6/addrconf.c
> +++ b/net/ipv6/addrconf.c
> @@ -374,8 +374,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
> "%s(): cannot allocate memory for statistics; dev=%s.\n",
> __func__, dev->name));
> neigh_parms_release(&nd_tbl, ndev->nd_parms);
> - ndev->dead = 1;
> - in6_dev_finish_destroy(ndev);
> + dev_put(dev);
> + kfree(ndev);
> return NULL;
> }
>
This seems a very old bug, and your fix applicable to old kernels as
well, thanks.
Could your patch title could be refined to the following ?
0) No need for the 1/1 suffix
1) include ipv6: prefix
2) change the message a bit, since normal operations are OK, only
failure and error recovery is buggy.
[PATCH] ipv6: fix a possible double free
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] snmp6 relevant data structures are freed twice.
2011-09-19 8:29 ` Eric Dumazet
@ 2011-09-19 8:32 ` Rongqing Li
0 siblings, 0 replies; 3+ messages in thread
From: Rongqing Li @ 2011-09-19 8:32 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netdev
On 09/19/2011 04:29 PM, Eric Dumazet wrote:
> Le lundi 19 septembre 2011 à 15:03 +0800, rongqing.li@windriver.com a
> écrit :
>> From: Roy.Li<rongqing.li@windriver.com>
>>
>> When calling snmp6_alloc_dev fails, the snmp6 relevant memory
>> are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy
>> will free these memory twice.
>>
>> Double free will lead that undefined behavior occurs.
>>
>> Signed-off-by: Roy.Li<rongqing.li@windriver.com>
>> ---
>> net/ipv6/addrconf.c | 4 ++--
>> 1 files changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
>> index 8f1e5be..ba01f72 100644
>> --- a/net/ipv6/addrconf.c
>> +++ b/net/ipv6/addrconf.c
>> @@ -374,8 +374,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
>> "%s(): cannot allocate memory for statistics; dev=%s.\n",
>> __func__, dev->name));
>> neigh_parms_release(&nd_tbl, ndev->nd_parms);
>> - ndev->dead = 1;
>> - in6_dev_finish_destroy(ndev);
>> + dev_put(dev);
>> + kfree(ndev);
>> return NULL;
>> }
>>
>
> This seems a very old bug, and your fix applicable to old kernels as
> well, thanks.
>
> Could your patch title could be refined to the following ?
>
> 0) No need for the 1/1 suffix
> 1) include ipv6: prefix
> 2) change the message a bit, since normal operations are OK, only
> failure and error recovery is buggy.
>
> [PATCH] ipv6: fix a possible double free
>
> Acked-by: Eric Dumazet<eric.dumazet@gmail.com>
>
>
>
Ok, I will resend it.
--
Best Reagrds,
Roy | RongQing Li
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-09-19 8:32 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-09-19 7:03 [PATCH 1/1] snmp6 relevant data structures are freed twice rongqing.li
2011-09-19 8:29 ` Eric Dumazet
2011-09-19 8:32 ` Rongqing Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).